Detection method and device, computer equipment, storage medium and computer program product

Abstract

The invention relates to a detection method and device, computer equipment, a storage medium and a computer program product, and the method comprises the steps: firstly obtaining the historical behavior data of a to-be-recognized object, then constructing a behavior index system of the to-be-recognized object according to the historical behavior data, and finally carrying out the recognition of the to-be-recognized object according to the behavior index system and an evaluation index system. And identifying the to-be-identified object to obtain an identification result. According to the method, the evaluation index system comprises various standard indexes, and the various standard indexes can reflect the information of the illegal behaviors in different aspects, so that the behavior index system and the evaluation index system are combined for analysis, and the incidence relation between the behaviors of the to-be-identified object and the illegal behaviors can be analyzed from multiple aspects; therefore, subsequent recognition of the to-be-recognized object based on the association relationship can realize comprehensive analysis, and the recognition accuracy is further improved.

Description

Technical Field

[0001] The present application relates to the field of storage network technology, and in particular to a detection method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the rapid development of Internet technology, big data and cloud computing have been widely used in enterprises, and distributed storage systems have gradually been applied to various fields. In distributed storage systems, the communication between many nodes depends on a stable and reliable network environment. When there is a problem with the network, it will cause serious consequences such as storage system IO performance degradation, system abnormality, and loss of important data. Therefore, it is of great significance to effectively detect the health status of the network.

[0003] Currently, when checking the health status of a network, the health status of the network is mainly checked by comparing whether the difference between the round-trip time (RTT) of two adjacent messages is greater than a preset threshold. However, the above detection method has the problem of inaccurate detection. Summary of the invention

[0004] Based on this, it is necessary to provide a detection method, apparatus, computer equipment, storage medium and computer program product that can improve detection accuracy in response to the above technical problems.

[0005] In a first aspect, the present application provides a detection method, applied to a target node, the method comprising:

[0006] Obtain the delay data of the message groups sent by other nodes in the transmission network;

[0007] Perform anomaly detection on the message group according to the delay data of the message group to obtain the detection result of the message group;

[0008] The health status of the transmission network is detected according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group that the target node has received.

[0009] The detection method provided in the embodiment of the present application obtains the delay data of the message group sent by other nodes in the transmission network, and then performs abnormal detection on the message group according to the delay data of the message group to obtain the detection result of the message group, and then detects the health status of the transmission network according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group that the target node has received. In the above method, the message group is firstly preliminarily detected, and then the transmission network is re-detected based on the preliminary detection result. The double detection can reduce the probability of missed detection or misjudgment, thereby improving the accuracy of the detection. In addition, the above method not only considers the current delay data in the process of detecting the transmission network, but also combines the historical delay data. Therefore, the method not only pays attention to the current network status but also considers the historical network status, thereby improving the comprehensiveness and reliability of the detection.

[0010] In one embodiment, the health status of the transmission network is detected according to the detection result of the message group and the detection result of the historical message group to obtain the detection result, including:

[0011] Determine at least one first message group according to the detection results of the first sliding window and the historical message group;

[0012] When the first message group meets the preset detection condition, the health status of the transmission network is detected according to the detection results corresponding to all message groups in the first sliding window to obtain the detection result.

[0013] The method described in the embodiment of the present application can detect the status of the message group in a fixed window by setting a sliding window, identify short-term anomalies in the data flow, and better discover and locate problems through centralized analysis of the data in the window, thereby reducing the delay in data processing and analysis and making the detection results more timely. Moreover, the sliding window allows the selection of a fixed-size window for analysis in the continuously flowing data, and the window size can be dynamically adjusted to adapt to different monitoring needs, thereby improving the flexibility of data processing.

[0014] In one of the embodiments, the health status of the transmission network is detected according to the detection results corresponding to all message groups in the first sliding window to obtain the detection results, including:

[0015] Determine the number of message groups whose detection results are abnormal for all message groups in the first sliding window;

[0016] If the number is greater than a first number threshold, determining that the detection result indicates that the health status of the transmission network is abnormal;

[0017] If the number is not greater than the first number threshold, at least one second message group is determined based on the detection results of the second sliding window and the historical message group, and the health status of the transmission network is detected based on the detection results corresponding to all message groups in the second sliding window to obtain the detection results.

[0018] In one of the embodiments, the health status of the transmission network is detected according to the detection results corresponding to all message groups in the second sliding window to obtain the detection results, including:

[0019] Determine the number of message groups whose detection results are abnormal for all message groups in the second sliding window;

[0020] If the number is greater than a second number threshold, determining that the detection result indicates that the health status of the transmission network is abnormal;

[0021] If the number is not greater than the second number threshold, it is determined that the detection result indicates that the health status of the transmission network is normal.

[0022] The method described in the embodiment of the present application uses a small sliding window for preliminary judgment and then uses a large sliding window for secondary judgment. The double detection can reduce the probability of missed detection or misjudgment, thereby improving the accuracy of detection.

[0023] In one embodiment, the method further comprises:

[0024] When the first message group does not meet the preset detection condition, determining at least one third message group according to the detection results of the third sliding window and the historical message group;

[0025] According to the detection results corresponding to all message groups in the third sliding window, the health status of the transmission network is detected to obtain the detection results.

[0026] The method described in the embodiment of the present application can improve the comprehensiveness of detection and prevent missed detection or misjudgment by using a large sliding window for detection when the first message group does not meet the preset detection conditions.

[0027] In one of the embodiments, an abnormality detection is performed on the message group according to the delay data of the message group to obtain a detection result of the message group, including:

[0028] The delay data of the message group is input into the neural network for anomaly detection to obtain the detection result of the message group.

[0029] The method described in the embodiment of the present application, since the neural network is trained based on a large amount of sample delay data, the accuracy and efficiency of network anomaly detection can be improved by using the neural network to perform preliminary detection of the transmission network status.

[0030] In one embodiment, obtaining delay data of a message group sent by other nodes in the transmission network includes:

[0031] Obtain the delay data of multiple messages sent by other nodes in the transmission network;

[0032] The delay data of each message is input into a correction algorithm for correction to obtain the corrected delay data of multiple messages, and the corrected delay data of multiple messages is determined as the delay data of the message group.

[0033] The method described in the embodiment of the present application is that in a distributed storage system, it is actually a normal phenomenon that "glitch" occurs at a certain moment. For example, when switching contexts, "glitch" may occur. By adopting Kalman's simplified algorithm to correct the delay data of the message, misjudgment caused by "glitch" on the spot can be prevented, thereby improving the accuracy of the detection result.

[0034] In one embodiment, the method further comprises:

[0035] According to the preset screening conditions, the delay data of the message groups sent by other nodes in the network are screened to obtain the screened delay data;

[0036] Anomaly detection is performed on the packet group according to the delay data of the packet group to obtain the detection result of the packet group, including:

[0037] Anomaly detection is performed on the message group according to the filtered delay data to obtain a detection result of the message group.

[0038] The method described in the embodiment of the present application performs preliminary screening of data of a large number of message groups by setting preset screening conditions, screens out message groups suspected to be abnormal, and then performs detection based on the delay data of the abnormal message groups, thereby improving detection efficiency.

[0039] In a second aspect, the present application also provides a detection device, the device comprising:

[0040] An acquisition module, used to acquire the delay data of the message group sent by other nodes in the transmission network;

[0041] A first detection module, used to perform abnormality detection on the message group according to the delay data of the message group, and obtain a detection result of the message group;

[0042] The second detection module is used to detect the health status of the transmission network according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group that the target node has received.

[0043] In a third aspect, the present application further provides a computer device, the computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0044] Obtain the delay data of the message groups sent by other nodes in the transmission network;

[0045] Perform anomaly detection on the message group according to the delay data of the message group to obtain the detection result of the message group;

[0046] The health status of the transmission network is detected according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group that the target node has received.

[0047] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0048] Obtain the delay data of the message groups sent by other nodes in the transmission network;

[0049] Perform anomaly detection on the message group according to the delay data of the message group to obtain the detection result of the message group;

[0050] The health status of the transmission network is detected according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group that the target node has received.

[0051] In a fifth aspect, the present application further provides a computer program product, the computer program product comprising a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0052] Obtain the delay data of the message groups sent by other nodes in the transmission network;

[0053] Perform anomaly detection on the message group according to the delay data of the message group to obtain the detection result of the message group;

[0054] The health status of the transmission network is detected according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group that the target node has received.

[0055] The above detection method, device, computer equipment, storage medium and computer program product, the method first obtains the historical behavior data of the object to be identified, then constructs the behavior index system of the object to be identified based on the historical behavior data, and finally identifies the object to be identified based on the behavior index system and the evaluation index system to obtain the identification result. In the above method, since the evaluation index system contains a variety of standard indicators, and the multiple standard indicators can reflect information on different aspects of illegal behaviors, the behavior index system and the evaluation index system are combined for analysis, and the correlation between the behavior of the object to be identified and the illegal behavior can be analyzed from multiple aspects. Therefore, the subsequent identification of the object to be identified based on the correlation relationship can achieve a comprehensive analysis, thereby improving the accuracy of identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A schematic diagram of the structure of a transmission network in an embodiment;

[0057] Figure 2 A schematic diagram of a detection method in an embodiment;

[0058] Figure 3 is a schematic flow chart of a detection method in another embodiment;

[0059] Figure 4 is a schematic flow chart of a detection method in another embodiment;

[0060] Figure 5 is a schematic flow chart of a detection method in another embodiment;

[0061] Figure 6 is a schematic flow chart of a detection method in another embodiment;

[0062] Figure 7 is a schematic flow chart of a detection method in another embodiment;

[0063] Figure 8 is a schematic flow chart of a detection method in another embodiment;

[0064] Fig. 9 is a schematic flow chart of a detection method in another embodiment;

[0065] Fig.10 is a structural block diagram of a detection device in an embodiment;

[0066] Fig.11 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0068] With the rapid development of Internet technology, big data and cloud computing have been widely used in enterprises, and distributed storage systems have gradually been applied to various fields. In a distributed storage system, the main control device distributes data and manages each storage node through the network. The communication between many nodes relies on a stable and reliable network environment. When there is a problem with the network, it will cause serious consequences such as degradation of the storage system IO performance, system abnormalities, and loss of important data. Therefore, it is of great significance to effectively detect the health status of the network. At present, when detecting the health status of the network, the detection of the network health status is mainly achieved by comparing whether the difference between the round-trip time (RTT) of two adjacent messages is greater than a preset threshold. However, the above detection method has the problem of inaccurate detection. The present application provides a detection method to solve the above technical problems. The following embodiments will specifically illustrate the detection method described in the present application.

[0069] The detection method provided in the embodiments of the present application can be applied to Figure 1 In the transmission network shown, the transmission network includes a target node 101 and multiple other nodes 102, and the target node 101 is connected to the multiple other nodes 102 by wire or wireless. The target node 101 is used to obtain the message delay data of the other nodes 102, and then detect the health status of the transmission network according to the message delay data. Among them, the transmission network can be a network of a storage system, and the target node 101 can be, but not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. Optionally, the target node 101 can be implemented with an independent server or a server cluster consisting of multiple servers. Other nodes 102 can be, but not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. Optionally, other nodes 10 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0070] Those skilled in the art will understand that Figure 1 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present application, and does not constitute a limitation on the transmission network to which the scheme of the present application is applied. The specific transmission network may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0071] In one embodiment, Figure 2As shown, a detection method is provided, which is applied to Figure 1 The target node in is taken as an example to illustrate, including the following steps:

[0072] S201, obtaining delay data of message groups sent by other nodes in the transmission network.

[0073] The transmission network includes multiple links. The delay data of the message group includes the delay data of multiple messages. The delay data is the round-trip delay of the message, which specifically includes sending delay, propagation delay, processing delay and queuing delay.

[0074] In an embodiment of the present application, during the process of detecting the health status of the current link of the transmission network by the target node, during the process of communication interaction on the current link by other nodes in the transmission network, the delay data corresponding to each message can be sent to the target node in real time. After the target node receives the message delay data within a preset number or a preset time period, the message delay data within the preset number or the preset time period can be used as the delay data of a message group for subsequent use. Optionally, the target node can actively obtain the message delay data generated by other nodes on the current link during the communication interaction in real time, and then after obtaining the message delay data within the preset number or the preset time period, use it as the delay data of a message group. Optionally, other nodes can store each message delay data in a database or cache. When the number of message delay data reaches a preset number, or the time for storing message delay data reaches a preset time period, the message delay data within the preset number or the preset time period can be sent to the target node. Optionally, when the number of message delay data reaches a preset number, or the time for storing message delay data reaches a preset time period, a message can be sent to remind the target node to actively go to the database or cache to obtain the delay data of the message group.

[0075] S202: Perform anomaly detection on the message group according to the delay data of the message group to obtain a detection result of the message group.

[0076] The detection result of the message group includes that the message group is in a normal state or that the message group is in an abnormal state.

[0077] In an embodiment of the present application, the target node can determine the delay threshold in advance based on historical data and network performance requirements. Then, after obtaining the delay data of the current message group, the target node can determine whether the delay data of each message in the current message group exceeds the delay threshold, and determine whether the number of messages whose delay data exceeds the delay threshold is greater than the number threshold. If it is greater, the detection result of the message group indicates that the current message group is in an abnormal state. If it is not greater, the detection result of the message group indicates that the current message group is in a normal state. Optionally, after obtaining the delay data of the current message group, the target node can input the delay data of the message group into a pre-trained detection network for anomaly detection to obtain the detection result of the message group. Optionally, after obtaining the delay data of the current message group, the target node can perform feature extraction on the delay data of the message group to obtain a delay feature, and then perform anomaly detection on the message group based on the extracted delay feature to obtain the detection result of the message group.

[0078] S203, detecting the health status of the transmission network according to the detection result of the message group and the detection result of the historical message group to obtain a detection result.

[0079] The historical message group is at least one message group received by the target node, specifically a historical message group, which may be multiple or one. The detection result includes that the health status of the transmission network is normal, or the health status of the transmission network is abnormal.

[0080] In the embodiment of the present application, after the target node obtains the detection result of the message group based on the above steps, the detection result of the message group and the detection result of the historical message group can be combined and analyzed. Specifically, it can be determined whether the number of abnormal message groups in the detection result of the message group and the detection results of all historical message groups exceeds the number threshold. If it exceeds, it is determined that the health state of the transmission network is abnormal. If it is not greater than, it is determined that the health state of the transmission network is normal. Optionally, after the target node obtains the detection result of the message group based on the above steps, it can obtain the detection result of the historical message group within a preset time period, and then determine to combine and analyze the detection result of the current message group with the detection result of the historical message group within the preset time period to detect the health state of the transmission network and obtain the detection result. Among them, the preset time period can be determined according to the network performance and the number of users, and can be 1 hour, one day, one month or one year, which is not limited in this embodiment. When the target node determines that the detection result indicates that the health state of the transmission network is abnormal, it can switch to a new link and issue an alarm prompt for the current link.

[0081] The detection method provided in the embodiment of the present application obtains the delay data of the message group sent by other nodes in the transmission network, and then performs abnormal detection on the message group according to the delay data of the message group to obtain the detection result of the message group, and then detects the health status of the transmission network according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group that the target node has received. In the above method, the message group is firstly preliminarily detected, and then the transmission network is re-detected based on the preliminary detection result. The double detection can reduce the probability of missed detection or misjudgment, thereby improving the accuracy of the detection. In addition, the above method not only considers the current delay data in the process of detecting the transmission network, but also combines the historical delay data. Therefore, the method not only pays attention to the current network status but also considers the historical network status, thereby improving the comprehensiveness and reliability of the detection.

[0082] In one embodiment, a specific implementation method for detecting the health status of a transmission network according to the detection results of a message group and the detection results of a historical message group is also provided, such as Figure 3 As shown, the above step S203 of "detecting the health status of the transmission network according to the detection result of the message group and the detection result of the historical message group to obtain the detection result" includes:

[0083] S301, determining at least one first message group according to detection results of a first sliding window and historical message groups.

[0084] Among them, the first sliding window is a sliding time window with a sliding window length of a first preset value. The first sliding window can store a preset number of detection results of message groups that have not exceeded the effective time. The preset number is determined by the sliding window length. Specifically, the first sliding window includes the detection result of the current message group and the detection results of (stored preset number-1) historical message groups with similar time, that is, the sum of the number of detection results of the current message group and the number of detection results of the historical message group is the preset number, and the detection result of the historical message group is closest to the detection result of the current message group in time. For example, if the preset number is 6, the first sliding window can store at most the detection result of the current message group and the detection results of the five most recent historical message groups that have not exceeded the effective time. If only the detection results of two message groups in the detection results of the historical message groups have not exceeded the effective time, then the content stored in the first sliding window is the detection result of the current message group and the detection results of the two most recent historical message groups that have not exceeded the effective time. When the effective value of the detection result of the message group is greater than the effective time threshold, the detection result of the message group is moved out of the first sliding window. The detection results of the historical message groups include the detection results of the message groups that exceed the effective time and the detection results of the message groups that do not exceed the effective time threshold. The number of the first message groups is the number of valid message groups in the first sliding window. In the above example, the number of the first message groups is 3, namely the current message group and the two most recent historical message groups that do not exceed the effective time.

[0085] In an embodiment of the present application, after the target node obtains the detection result of the current message group, since the detection result of the current message group has not reached the valid time, the detection result of the current message group can be recorded in the first sliding window, and it is determined whether the detection results of other message groups in the first sliding window exceed the valid time, and the detection results of the historical message groups that exceed the valid time are moved out of the first sliding window. Then, the target node can determine the first message group based on the detection result of the current message group and the detection results of the historical message groups that have not exceeded the valid time.

[0086] S302, when the first message group meets the preset detection condition, the health status of the transmission network is detected according to the detection results corresponding to all message groups in the first sliding window to obtain the detection result.

[0087] The preset detection condition is whether the number of first message groups reaches a preset number.

[0088] In an embodiment of the present application, after the target node obtains the first message group based on the above steps, it can further determine whether the preset detection condition is met according to the number of the first message group. If it is met, in this case, it means that the detection results of the preset number of message groups in the first sliding window have not exceeded the effective time. For example, the preset number is 6, then when the number of message groups in the first sliding window is 6, and the detection results of these 6 message groups have not exceeded the effective time. In the case where the first message group meets the preset detection condition, the health status of the transmission network can be detected according to the proportion of abnormal results in the detection results corresponding to all message groups in the first sliding window to obtain the detection result.

[0089] The method described in the embodiment of the present application can detect the status of the message group in a fixed window by setting a sliding window, identify short-term anomalies in the data flow, and better discover and locate problems through centralized analysis of the data in the window, thereby reducing the delay in data processing and analysis and making the detection results more timely. Moreover, the sliding window allows the selection of a fixed-size window for analysis in the continuously flowing data, and the window size can be dynamically adjusted to adapt to different monitoring needs, thereby improving the flexibility of data processing.

[0090] In one embodiment, a specific implementation method for detecting the health status of the transmission network according to the detection results corresponding to all message groups in the first sliding window is also provided, such as Figure 4 As shown, the above step S302 of "detecting the health status of the transmission network according to the detection results corresponding to all message groups in the first sliding window to obtain the detection results" includes:

[0091] S401, determine the number of message groups with abnormal detection results, and determine whether the number of abnormal message groups is greater than a first number threshold, if greater, execute S402, if not greater, execute S403.

[0092] The message group in the abnormal message group is in an abnormal state. The first quantity threshold can be set according to requirements. For example, if the first sliding window length is 6, the first quantity threshold can be set to 4.

[0093] In the embodiment of the present application, after the target node obtains the detection results corresponding to all the message groups in the first sliding window, it can further determine the number of abnormal message groups in the first sliding window.

[0094] S402, determining that the detection result indicates that the health status of the transmission network is abnormal.

[0095] In the embodiment of the present application, if the number of abnormal message groups in the first sliding window is greater than the first number threshold, it is determined that the detection result indicates that the health status of the transmission network is abnormal.

[0096] S403, determining at least one second message group according to the detection results of the second sliding window and the historical message group, and detecting the health status of the transmission network according to the detection results corresponding to all message groups in the second sliding window to obtain a detection result.

[0097] The principle of the second sliding window is similar to that of the first sliding window, the sliding window length of the second sliding window is greater than that of the first sliding window, and the number and validity period of the detection results of the message groups that can be stored in the second sliding window are greater than those of the first sliding window. For example, the first sliding window can store 6 detection results with a validity period of no more than 20 minutes, and the second sliding window can store 100 detection results with a validity period of no more than 2 hours.

[0098] In the embodiment of the present application, if the number in the first sliding window is not greater than the first number threshold, at least one second message group in the second sliding window is determined based on the detection results of the second sliding window and the historical message group, and the health status of the transmission network is detected based on the detection results corresponding to all message groups in the second sliding window to obtain the detection result. Specifically, the health status of the transmission network can be detected based on the proportion of abnormal results in the detection results corresponding to all message groups in the second sliding window to obtain the detection result.

[0099] Optional, such as Figure 5 As shown, the above step S403 of "detecting the health status of the transmission network according to the detection results corresponding to all message groups in the second sliding window to obtain the detection results" includes:

[0100] S4031, determine the number of message groups whose detection results are abnormal for all message groups in the second sliding window, and determine whether the number of abnormal message groups is greater than a second number threshold, if so, execute S4032, if not, execute S4033.

[0101] The second quantity threshold can be set according to demand. For example, the second sliding window length is 100 and the first quantity threshold can be set to 60.

[0102] In the embodiment of the present application, after the target node obtains the detection results corresponding to all the message groups in the second sliding window, it can further determine the number of abnormal message groups in the second sliding window.

[0103] S4032: Determine that the detection result indicates that the health status of the transmission network is abnormal.

[0104] In the embodiment of the present application, if the number in the second sliding window is greater than the second number threshold, it is determined that the detection result indicates that the health status of the transmission network is abnormal.

[0105] S4033: Determine that the detection result indicates that the health status of the transmission network is normal.

[0106] In the embodiment of the present application, if the number in the second sliding window is not greater than the second number threshold, it is determined that the detection result indicates that the health status of the transmission network is normal.

[0107] It should be noted that, in order to further improve the accuracy of the detection result, a larger sliding window can be set, and multiple detections can be performed on the basis of the second sliding window.

[0108] The method described in the embodiment of the present application uses a small sliding window for preliminary judgment and then uses a large sliding window for secondary judgment. The double detection can reduce the probability of missed detection or misjudgment, thereby improving the accuracy of detection.

[0109] In one embodiment, a detection method is also provided when the first message group does not meet the preset detection condition, such as Figure 6 As shown, the above detection method also includes:

[0110] S501: When the first message group does not satisfy a preset detection condition, determine at least one third message group according to detection results of a third sliding window and historical message groups.

[0111] The sliding window length, the number of detection results of message groups that can be stored, and the effective time of the third sliding window are greater than those of the first sliding window. The third sliding window can be the same as or different from the second sliding window.

[0112] In the embodiment of the present application, after obtaining the first message group, the target node can further determine whether the preset detection condition is met according to the number of the first message group. If not, in this case, it means that the number of message groups in the first sliding window is not the preset number, and the reason may be that the detection results of the message groups that have exceeded the effective time are removed. If the first message group does not meet the preset detection condition, at least one third message group in the third sliding window is determined according to the detection results of the third sliding window and the historical message group.

[0113] S502: Detect the health status of the transmission network according to the detection results corresponding to all message groups in the third sliding window to obtain a detection result.

[0114] In an embodiment of the present application, after the target node obtains the detection results corresponding to all message groups in the third sliding window, the number of abnormal message groups in the third sliding window can be further determined. If the number in the third sliding window is greater than the third quantity threshold, it is determined that the detection result indicates that the health state of the transmission network is abnormal. If the number is not greater than the third quantity threshold, it is determined that the detection result indicates that the health state of the transmission network is normal. The third quantity threshold is greater than the first quantity threshold, and the third quantity threshold may be the same as the second quantity threshold or may be different.

[0115] The method described in the embodiment of the present application can improve the comprehensiveness of detection and prevent missed detection or misjudgment by using a large sliding window for detection when the first message group does not meet the preset detection conditions.

[0116] In one embodiment, a specific implementation method for performing anomaly detection on a message group based on delay data of the message group is also provided. The above step S203 of "performing anomaly detection on the message group based on the delay data of the message group to obtain a detection result of the message group" includes: inputting the delay data of the message group into a neural network for anomaly detection to obtain a detection result of the message group.

[0117] Among them, the neural network is a BP neural network. The BP neural network is a classic reverse gradient descent optimization neural network with self-learning ability, generally composed of a multi-layer perceptron and an activation function. The network mainly includes an input layer, a hidden layer, an activation layer, and an output layer. The features are weighted and summed through the input layer, and each layer is nonlinearly mapped through a specific activation function. It can learn the correlation properties between features and difficult-to-understand implicit features, and optimize parameters through reverse gradient descent. It can easily fit various complex mapping relationships and has good prediction performance.

[0118] The forward propagation of BP neural network can be expressed as:

[0119]

[0120] in, is the output of each layer, is the activation function, is the weight coefficient matrix, is the feature matrix, is the offset.

[0121] The learning goal is , the error is , then the reverse gradient descent can be expressed as:

[0122]

[0123] In the embodiment of the present application, sample delay data can be obtained in advance, specifically, training and data of network anomalies and network sub-health can be obtained by down / up network cards, IO flow, setting firewall traffic, etc., and then the initial BP neural network is trained according to the sample delay data, BP neural network forward propagation and reverse gradient descent to obtain a trained neural network. When it is necessary to perform status detection on the current transmission network, after the target node obtains the delay data of the message group, the delay data of the message group can be input into the trained neural network, and anomaly detection is performed through the trained neural network to obtain the detection result of the message group.

[0124] The method described in the embodiment of the present application, since the neural network is trained based on a large amount of sample delay data, the accuracy and efficiency of network anomaly detection can be improved by using the neural network to perform preliminary detection of the transmission network status.

[0125] In one embodiment, a method for correcting the delay data of a message to obtain the delay data of a message group is also provided. Figure 7 As shown, the "obtaining delay data of the message group sent by other nodes in the transmission network" in the above step S201 includes:

[0126] S601, obtaining delay data of multiple messages sent by other nodes in the transmission network.

[0127] In an embodiment of the present application, during the process of detecting the health status of the current link of the transmission network by the target node, during the process of communication interaction on the current link by other nodes in the transmission network, the delay data corresponding to each message can be sent to the target node in real time. Optionally, the target node can actively obtain the message delay data generated by other nodes on the current link during the communication interaction in real time. Optionally, other nodes can send each message delay data to the target node.

[0128] S602: Input the delay data of each message into a correction algorithm for correction to obtain the corrected delay data of multiple messages, and determine the corrected delay data of multiple messages as the delay data of the message group.

[0129] Among them, the correction algorithm is the Kalman algorithm.

[0130] In the embodiment of the present application, the existing Kalman algorithm can be optimized in advance according to the delay data of the message in the transmission network to obtain the optimized Kalman algorithm. After the target node obtains the delay data of a message based on the above steps, the delay data of the message can be input into the correction algorithm for correction to obtain the delay data of the corrected message. Similarly, after obtaining the delay data of a new message, it is corrected. When the preset time period or preset number is reached, the delay data of the message after the preset time period or preset number of corrections can be determined as the delay data of the message group.

[0131] Specifically, the optimized Kalman algorithm can be expressed by the following relationship:

[0132]

[0133]

[0134]

[0135]

[0136]

[0137] in, is the prior error at time k, is the posterior error at time k-1, is the posterior error at time k, is the covariance matrix, is the Kalman gain at time k, is the delay data of multiple messages after correction at time k, is the delay data of the message after correction at time k-1, is the actual delay data of the message at time k, is the sending delay of the sender, is the sending delay of the receiving end at time k-1.

[0138] The method described in the embodiment of the present application is that in a distributed storage system, it is actually a normal phenomenon that "glitch" occurs at a certain moment. For example, when switching contexts, "glitch" may occur. By adopting Kalman's simplified algorithm to correct the delay data of the message, misjudgment caused by "glitch" on the spot can be prevented, thereby improving the accuracy of the detection result.

[0139] In one embodiment, a method for screening the delay data of the message group sent by other nodes in the network is also provided, such as Figure 8 As shown, the method includes:

[0140] S204, screening the delay data of the message groups sent by other nodes in the network according to the preset screening conditions, and obtaining screened delay data.

[0141] Among them, the preset screening condition is used to filter out the delay data of the suspected abnormal message group through the delay characteristics. The preset screening condition is that the delay characteristic is greater than the delay characteristic threshold, the delay characteristic includes at least one of the delay rate, packet loss rate, network jitter rate, abnormal delay, and average delay, and the delay characteristic threshold includes at least one of the delay rate threshold, packet loss rate threshold, network jitter rate threshold, abnormal delay threshold, and average delay threshold. Specifically, the preset screening conditions include: the delay rate is greater than the delay rate threshold, the packet loss rate is greater than the packet loss rate threshold, the network jitter rate is greater than the network jitter rate threshold, the abnormal delay is greater than the abnormal delay threshold, and the average delay is greater than the average delay threshold.

[0142] In the embodiment of the present application, preset screening conditions can be pre-set, for example, the delay rate threshold is 0.5%, the packet loss rate threshold is 3%, the network jitter rate threshold is 1%, the abnormal delay threshold is 300us, and the average delay threshold is 100us. After the target node obtains the delay data of the message group sent by other nodes, it can determine the delay characteristics based on the delay data of the message group and the preset formula, and then compare each delay characteristic with the corresponding delay characteristic threshold to determine whether there is a delay characteristic whose delay characteristic is greater than the delay threshold. If so, the delay data of the message group is determined as the screened delay data, that is, the message group is suspected to be an abnormal message group.

[0143] Correspondingly, when the target node executes step S202 "perform anomaly detection on the message group according to the delay data of the message group to obtain the detection result of the message group", the specific execution steps are: perform anomaly detection on the message group according to the filtered delay data to obtain the detection result of the message group.

[0144] In an embodiment of the present application, after the target node obtains the filtered delay data based on the above steps, it can perform anomaly detection on the message group according to the filtered delay data to obtain the detection result of the message group.

[0145] The method described in the embodiment of the present application performs preliminary screening of data of a large number of message groups by setting preset screening conditions, screens out message groups suspected to be abnormal, and then performs detection based on the delay data of the abnormal message groups, thereby improving detection efficiency.

[0146] Based on all the above embodiments, a detection method is also provided. Fig. 9 As shown, the method includes:

[0147] S701, obtaining delay data of multiple messages sent by other nodes in the transmission network.

[0148] S702, inputting the delay data of each message into a correction algorithm for correction, obtaining the corrected delay data of a plurality of messages, and determining the corrected delay data of the plurality of messages as the delay data of the message group.

[0149] S703, filtering the delay data of the message groups sent by other nodes in the network according to the preset filtering conditions to obtain filtered delay data.

[0150] S704: Perform anomaly detection on the message group according to the filtered delay data to obtain a detection result of the message group.

[0151] S705: Determine at least one first message group according to the detection results of the first sliding window and the historical message groups.

[0152] S706, determine whether the first message group meets a preset detection condition, if yes, execute S707, if not, execute S714.

[0153] S707: Determine the number of message groups whose detection results corresponding to all message groups in the first sliding window are abnormal.

[0154] S708, determining whether the number of abnormal message groups in the first sliding window is greater than a first number threshold, if so, executing S709, if not, executing S710.

[0155] S709: Determine that the detection result indicates that the health status of the transmission network is abnormal.

[0156] S710: Determine the number of message groups whose detection results corresponding to all message groups in the second sliding window are abnormal.

[0157] S711, determine whether the number of abnormal message groups in the second sliding window is greater than a second number threshold, if so, execute S712, if not, execute S713.

[0158] S712, determining that the detection result indicates that the health status of the transmission network is abnormal.

[0159] S713: Determine that the detection result indicates that the health status of the transmission network is normal.

[0160] S714: Determine at least one third message group according to the detection results of the third sliding window and the historical message groups.

[0161] S715: Determine the number of message groups whose detection results corresponding to all message groups in the third sliding window are abnormal.

[0162] S716, determine whether the number of abnormal message groups in the third sliding window is greater than a third number threshold, if so, execute S717, if not, execute S718.

[0163] S717, determining that the detection result indicates that the health status of the transmission network is abnormal.

[0164] S718, determining that the detection result indicates that the health status of the transmission network is normal.

[0165] The method described in the embodiment of the present application uses the Kalman algorithm to estimate and optimize the RTT delay data, which is more stable than directly measuring the RTT delay. At the same time, the delay characteristics are sampled to estimate the delay data, and abnormal delay data is preliminarily screened out. Then, a large amount of data is combined to train the BP neural network to mine the intrinsic connection between each feature, and the health status is predicted through the trained BP neural network model. The obtained results are filtered in the sliding window to decide the final result. Compared with other traditional network detection models, it has higher accuracy and can reduce the probability of misjudgment, especially in network health status detection based on RDMA technology. This method has better stability and reliability.

[0166] The methods described in the above steps are all described in the above embodiments. Please refer to the above description for details and will not be repeated here.

[0167] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0168] Based on the same inventive concept, the embodiment of the present application also provides a detection device for implementing the detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more detection device embodiments provided below can refer to the limitations on the detection method above, and will not be repeated here.

[0169] In one embodiment, Fig.10 As shown, a detection device is provided, comprising:

[0170] The acquisition module 11 is used to acquire the delay data of the message groups sent by other nodes in the transmission network.

[0171] The first detection module 12 is used to perform abnormality detection on the message group according to the delay data of the message group to obtain the detection result of the message group.

[0172] The second detection module 13 is used to detect the health status of the transmission network according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group that the target node has received.

[0173] In one embodiment, the second detection module 13 includes:

[0174] The first determining unit is used to determine at least one first message group according to the detection results of the first sliding window and the historical message groups.

[0175] The first detection unit is used to detect the health status of the transmission network and obtain a detection result according to the detection results corresponding to all message groups in the first sliding window when the first message group meets the preset detection condition.

[0176] In one embodiment, the first detection unit comprises:

[0177] The first determining subunit is used to determine the number of message groups whose detection results corresponding to all message groups in the first sliding window are abnormal.

[0178] The second determining subunit is configured to determine, if the number is greater than a first number threshold, that the detection result indicates that the health state of the transmission network is abnormal.

[0179] The third determination subunit is used to determine at least one second message group based on the detection results of the second sliding window and the historical message group if the number is not greater than the first number threshold, and to detect the health status of the transmission network based on the detection results corresponding to all message groups in the second sliding window to obtain the detection results.

[0180] In one embodiment, the above-mentioned third determination subunit is specifically used to determine the number of message groups whose detection results corresponding to all message groups in the second sliding window are abnormal; if the number is greater than the second number threshold, it is determined that the detection result indicates that the health status of the transmission network is abnormal; if the number is not greater than the second number threshold, it is determined that the detection result indicates that the health status of the transmission network is normal.

[0181] In one embodiment, the second detection module 13 includes:

[0182] The second determining unit is used to determine at least one third message group according to the detection results of the third sliding window and the historical message group when the first message group does not meet the preset detection condition.

[0183] The second detection unit is used to detect the health status of the transmission network according to the detection results corresponding to all message groups in the third sliding window to obtain the detection results.

[0184] In one embodiment, the first detection module 12 is specifically used to input the delay data of the message group into the neural network for anomaly detection to obtain the detection result of the message group.

[0185] In one embodiment, the acquisition module 11 includes:

[0186] The acquisition unit is used to acquire delay data of multiple messages sent by other nodes in the transmission network.

[0187] The correction unit is used to input the delay data of each message into the correction algorithm for correction, obtain the corrected delay data of multiple messages, and determine the corrected delay data of multiple messages as the delay data of the message group.

[0188] In one embodiment, the detection device further includes:

[0189] The screening module is used to screen the delay data of the message groups sent by other nodes in the network according to the preset screening conditions to obtain the screened delay data.

[0190] Correspondingly, the first detection module 12 is specifically configured to perform anomaly detection on the message group according to the filtered delay data to obtain a detection result of the message group.

[0191] Each module in the above detection device can be implemented in whole or in part by software, hardware and a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0192] In one embodiment, a computer device is provided. The computer device may be a terminal or a server. The internal structure diagram thereof may be as follows: Fig.11As shown, the computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a detection method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0193] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0194] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of the detection method described in any of the above embodiments are implemented.

[0195] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the detection method described in any of the above embodiments are implemented.

[0196] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of the detection method described in any of the above embodiments when executed by a processor.

[0197] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0198] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0199] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A detection method, characterized in that: Applied to a target node, the method comprises: Obtain the delay data of the message groups sent by other nodes in the transmission network; Performing anomaly detection on the message group according to the delay data of the message group to obtain a detection result of the message group; The health status of the transmission network is detected according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group that the target node has received.

2. The method according to claim 1, characterized in that The detecting the health status of the transmission network according to the detection result of the message group and the detection result of the historical message group to obtain the detection result includes: Determine at least one first message group according to the detection results of the first sliding window and the historical message group; In the case where the first message group meets a preset detection condition, the health status of the transmission network is detected according to the detection results corresponding to all message groups in the first sliding window to obtain a detection result.

3. The method according to claim 2, characterized in that The detecting the health status of the transmission network according to the detection results corresponding to all message groups in the first sliding window to obtain the detection results includes: Determine the number of message groups whose detection results are abnormal for all message groups in the first sliding window; If the number is greater than a first number threshold, determining that the detection result indicates that the health status of the transmission network is abnormal; If the number is not greater than the first number threshold, at least one second message group is determined based on the detection results of the second sliding window and the historical message group, and the health status of the transmission network is detected based on the detection results corresponding to all message groups in the second sliding window to obtain a detection result.

4. The method according to claim 3, characterized in that The detecting the health status of the transmission network according to the detection results corresponding to all message groups in the second sliding window to obtain the detection results includes: Determine the number of message groups whose detection results corresponding to all message groups in the second sliding window are abnormal; If the number is greater than a second number threshold, determining that the detection result indicates that the health status of the transmission network is abnormal; If the number is not greater than a second number threshold, it is determined that the detection result indicates that the health status of the transmission network is normal.

5. The method according to claim 2, characterized in that: The method further comprises: In the case where the first message group does not meet the preset detection condition, determining at least one third message group according to the detection results of the third sliding window and the historical message group; According to the detection results corresponding to all the message groups in the third sliding window, the health status of the transmission network is detected to obtain the detection results.

6. The method according to any one of claims 1 to 5, characterized in that: The performing abnormality detection on the message group according to the delay data of the message group to obtain the detection result of the message group includes: The time delay data of the message group is input into a neural network for abnormality detection to obtain a detection result of the message group.

7. The method according to any one of claims 1 to 5, characterized in that: The obtaining of delay data of message groups sent by other nodes in the transmission network includes: Obtaining delay data of multiple messages sent by other nodes in the transmission network; The delay data of each message is input into a correction algorithm for correction to obtain the corrected delay data of multiple messages, and the corrected delay data of multiple messages is determined as the delay data of the message group.

8. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: According to a preset screening condition, the delay data of the message groups sent by other nodes in the network are screened to obtain screened delay data; The performing abnormality detection on the message group according to the delay data of the message group to obtain the detection result of the message group includes: Anomaly detection is performed on the message group according to the filtered delay data to obtain a detection result of the message group.

9. A detection device, characterized in that: The device comprises: An acquisition module, used to acquire the delay data of the message group sent by other nodes in the transmission network; A first detection module, configured to perform anomaly detection on the message group according to the delay data of the message group, and obtain a detection result of the message group; The second detection module is used to detect the health status of the transmission network according to the detection result of the message group and the detection result of the historical message group to obtain the detection result; the historical message group is at least one message group received by the target node.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images